security_identifier

CVE-2026-42208

Critical pre-authentication SQL injection in LiteLLM's key-verification path, affecting versions 1.81.16 through 1.83.6.

Current clusters

security1 distinct publisher

Exposed AI tooling now outnumbers exposed ICS hosts by more than two to one

Censys counts more than 294,000 public IPs running one of 43 AI or LLM tools, up from roughly 183,000 in October 2025. The two platforms it names for growth, Langflow and LiteLLM, both carry KEV-listed flaws.

Publishers:esecurityplanet.com

Reality

Evidence44
Adoption63
Hype gap+16
Incentives71

security1 distinct publisher

Someone enumerated LiteLLM's key tables 36 hours after the advisory hit defender feeds

Sysdig logged a pre-auth SQL injection probe against CVE-2026-42208 from an operator who already had the Prisma schema casing right, which is the argument for putting LLM gateways on the same patch clock as edge appliances.

Publishers:sysdig.com

Reality

Evidence64
Adoption38